CVE-2017-5656

Severity

3.5

Description

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens that are associated with delegation tokens, which means that an attacker could craft a token which would return an identifer corresponding to a cached token for another user.

Mitigation

We recommend upgrading to a version of this component that is not vulnerable to this specific issue.

Related links:

http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-5656

http://cxf.apache.org/security-advisories.data/CVE-2017-5656.txt

Project

Category

Apache CXF's STSClient uses a flawed way of caching tokens that are associated with delegation tokens.

Tags

data

Date Disclosed

2017-04-18

Date Discovered

2017-01-29

Apache TomEE 7.0.x

First release:

2016-05-17

0

Support Lifecycle:

Maintenance Support

Namespace:

javax

7.0.0 7.0.1 7.0.2 7.0.3

Apache TomEE 1.7.x

First release:

2014-08-09

0

Support Lifecycle:

Namespace:

javax

1.7.0 1.7.1 1.7.2 1.7.3 1.7.4 1.7.5

Apache TomEE 1.6.x

First release:

2013-11-17

0

Support Lifecycle:

Namespace:

javax

1.6.0 1.6.0.1 1.6.0.2

Apache TomEE 1.5.x

First release:

2012-09-28

0

Support Lifecycle:

Namespace:

javax

1.5.0 1.5.1 1.5.2

Apache TomEE 1.0.x

First release:

2012-04-27

0

Support Lifecycle:

Namespace:

javax

Feel Vulnerable?

Contact us so we can help you.

First name ^*
Last name ^*
Email ^*
Company ^*
Product ^*
Heard about us from: ^*
Tell us more ^*

Send me a confirmation email

^* These fields are required.